SkillSpector · polars-bio

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

polars_bio_runner.py

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

polars_bio_runner.py

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

polars_bio_runner.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

tests/test_polars_bio.py

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

SKILL.md